CVE-2024-51224

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-51224", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-03-23T16:52:09.544Z", "dateReserved": "2024-10-28T00:00:00.000Z", "datePublished": "2026-03-23T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-23T15:24:58.138Z"}, "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the component /admin/edit-vehicle.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the vehiclename, modelnumber, regnumber, vehiclesubtype, chasisnum and enginenumber parameters."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/Buckdray/vulnerability-research"}, {"url": "https://github.com/Buckdray/vulnerability-research/tree/main/CVE-2024-51224"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T16:52:03.284486Z", "id": "CVE-2024-51224", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T16:52:09.544Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-51224", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T16:52:03.284486Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T16:51:30.611Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/Buckdray/vulnerability-research"}, {"url": "https://github.com/Buckdray/vulnerability-research/tree/main/CVE-2024-51224"}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the component /admin/edit-vehicle.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the vehiclename, modelnumber, regnumber, vehiclesubtype, chasisnum and enginenumber parameters."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-23T15:24:58.138Z"}}}, "cveMetadata": {"cveId": "CVE-2024-51224", "state": "PUBLISHED", "dateUpdated": "2026-03-23T16:52:09.544Z", "dateReserved": "2024-10-28T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-23T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phpgurukul:vehicle_record_management_system:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "D6AE144F-2A5F-4F48-899F-732293FA1DB6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the component /admin/edit-vehicle.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the vehiclename, modelnumber, regnumber, vehiclesubtype, chasisnum and enginenumber parameters."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de cross-site scripting (XSS) en el componente /admin/edit-vehicle.php de Phpgurukul Vehicle Record Management System v1.0 permite a atacantes ejecutar scripts web o HTML arbitrarios mediante la inyecci\u00f3n de una carga \u00fatil manipulada en los par\u00e1metros vehiclename, modelnumber, regnumber, vehiclesubtype, chasisnum y enginenumber."}], "id": "CVE-2024-51224", "lastModified": "2026-06-17T08:05:31.090", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-51224", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T16:52:03.284486Z", "version": "2.0.3"}}]}, "published": "2026-03-23T16:16:31.710", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/Buckdray/vulnerability-research"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://github.com/Buckdray/vulnerability-research/tree/main/CVE-2024-51224"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "vehicle_record_management_system", "vendor": "phpgurukul"}], "analysis": {"en": {"generated_at": "2026-03-24T19:30:24.506761+00:00", "value": {"mitigation_remediation": ["Check for an updated version of the Phpgurukul Vehicle Record Management System that fixes the XSS issue and apply the update.", "If no update is available, implement server\u2011side validation and output encoding for the vehiclename, modelnumber, regnumber, vehiclesubtype, chasisnum and enginenumber parameters to prevent XSS.", "Deploy a Content Security Policy that restricts script execution to trusted sources.", "Monitor administrative activity logs for suspicious input patterns and investigate anomalies."], "summary": {"action": "Apply patch", "impact": "Client\u2011side Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Phpgurukul Vehicle Record Management System at version\u202f1.0, as identified by the component path and CPE string. No other versions or products are explicitly mentioned, so the impact is limited to installations running that exact version.", "description_and_impact": "Multiple cross\u2011site scripting (XSS) vulnerabilities exist in the /admin/edit\u2011vehicle.php component of Phpgurukul Vehicle Record Management System version\u202f1.0. Attackers can inject crafted payloads into the vehiclename, modelnumber, regnumber, vehiclesubtype, chasisnum and enginenumber parameters to execute arbitrary web scripts or HTML. This enables malicious actors to run arbitrary client\u2011side code within the context of the application, potentially leading to data theft, credential compromise or defacement.", "risk_and_exploitability": "With a CVSS score of 4.8, the vulnerability is classified as medium severity. The EPSS score of below 1\u202f% indicates a low likelihood of widespread exploitation, and the issue is not listed in the CISA KEV catalog. The vulnerability is likely exploitable by submitting crafted HTTP requests to the protected /admin interface, typically requiring authenticated access or at least access to the edit\u2011vehicle page. Attackers can leverage the unescaped input fields to inject malicious scripts that run in end\u2011user browsers."}}}}, "created": "2026-03-24T10:35:06.621003+00:00", "title": "Cross\u2011Site Scripting in Vehicle Record Management System v1.0", "updated": "2026-03-25T14:50:15.806302+00:00", "vendors": ["phpgurukul", "phpgurukul$PRODUCT$vehicle_record_management_system"]}